Repository navigation
feature: add ngx.ssl.get_req_ssl_ctx(). - #548
Merged
zhuizhuhaomeng merged 2 commits intoNov 8, 2026
Merged
Conversation
Expose the downstream session SSL_CTX pointer through the HTTP and stream FFI exports. Preserve Nginx session_ctx semantics after SNI selection and return a borrowed void pointer with the existing ngx.ssl error convention. Only export the Lua getter when its C symbol is available so older binaries can still load ngx.ssl and callers can select a fallback. Document ownership and availability, and cover request errors, TLS phases, repeated reads, SNI, and missing-symbol compatibility. Validation: 60 new and 856 existing SSL assertions pass on Nginx 1.31.8 with OpenSSL 3.5.9. A real older binary without the symbol still loads ngx.ssl. Luacheck and git diff --check pass.
Require the HTTP and stream C getters when loading ngx.ssl and export the Lua getter unconditionally. Remove the missing-symbol compatibility tests and document the corresponding module requirement. Validation: the request SSL_CTX and existing SSL suites pass for HTTP and stream, along with the lua-resty-openssl SSL suite. Luacheck and git diff --check pass.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add
ngx.ssl.get_req_ssl_ctx()for HTTP and stream, returning the borrowed downstreamsession_ctxpointer asvoid *cdata. Lua libraries can use this API to obtain anSSL_CTX*without an auxiliary module or direct reads of Nginx structure layouts.The getter preserves Nginx's original session context when SNI changes the active context returned by
SSL_get_SSL_CTX(). It raisesno request foundwithout a request and returnsnil, errfor unavailable SSL state. The Lua API binds directly to the C export and requires the corresponding module update.C exports are provided by lua-nginx-module #2546 and stream-lua-nginx-module #420. The consumer change is in lua-resty-openssl #243.
Validation with the combined Nginx 1.31.8 / OpenSSL 3.5.9 build:
t/ssl-ctx.tandt/stream/ssl-ctx.t: 48 assertions passed, covering errors, certificate/content phases, repeated reads, and SNI.t/ssl.tandt/stream/ssl.t: 856 assertions passed.ssl_ctx.from_request()works with legacy loading forbidden.git diff --checkpass.